Government websites, public services and major online platforms have been forced offline after security researchers uncovered a critical vulnerability in PHP, a programming language that underpins a vast proportion of the internet.
The flaw could allow attackers to execute their own code on vulnerable web servers, potentially opening the door to stolen personal information, compromised networks and large-scale fraud. The UK’s National Cyber Security Centre (NCSC), part of GCHQ, has urged organisations to install a patched version of PHP or take affected websites offline if they cannot update them.
The discovery has triggered precautionary shutdowns across Britain and parts of Europe, exposing the risks associated with a programming language embedded in millions of websites, from government services to commercial platforms.
The Office for Budget Responsibility (OBR) confirmed it had taken its website offline in response to the threat, citing “the critical security issues affecting PHP”. Oxford City Council and the City of Edinburgh Council have also been affected, and some government online services and BBC programme pages have become temporarily unavailable.
Public services in Finland, France and Denmark have also been partly disabled as organisations move to limit their exposure.
Downing Street has said the impact on government services is expected to be minimal. Ministers have also sought to reassure markets that the security issue has not compromised next week’s Budget.
A flaw with potentially far-reaching consequences
PHP, created by Danish-Canadian programmer Rasmus Lerdorf in the early 1990s, remains a fundamental component of the web. It is used by major websites and services including Etsy, Wikipedia and NASA.gov, as well as widely deployed platforms such as WordPress and Magento.
WordPress alone is estimated to power about 40 per cent of websites worldwide, illustrating how a vulnerability in widely used underlying software can ripple across organisations and sectors.
The newly identified weakness is a remote code execution (RCE) vulnerability — a category of security flaw that can allow an attacker to run unauthorised commands on a target server.
That access could enable criminals to extract passwords, payment information and other sensitive data, move deeper into an organisation’s network or install a backdoor for future attacks. Compromised websites could also be used to expose visitors to further threats.
Alan Woodward, a visiting computer science professor at the Surrey Centre for Cyber Security, told BBC Radio 4’s Today programme that the vulnerability was serious because of both its scale and its nature.
An attacker able to run code on a server could steal data, reach other parts of a network or establish a way back into the system later, he explained.
Ciaran Martin, the former head of the NCSC, warned that the weaknesses could increase the risk of personal data theft and subsequent scams. Criminals who obtained sensitive information could use it to impersonate individuals, facilitate fraud or gain a foothold for more damaging attacks.
“All that sort of scamming and fraud and so forth gets turbocharged,” he told Times Radio.
AI enters the cybersecurity battle
The episode has also highlighted the increasingly important — and potentially dangerous — role of artificial intelligence in finding software vulnerabilities.
OpenAI said it had spent the previous two months leading a team of researchers working to address the PHP flaw and supporting developers as they prepared fixes.
The company described the incident as “one of the most impactful security issues in recent memory”, while warning that the same advances that help defenders identify weaknesses could also assist attackers.
“To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a defender’s window for maintainers and security providers to prepare fixes and protections ahead of disclosure,” OpenAI said.
That window may prove crucial. Cloudflare chief executive Matthew Prince reported a dramatic surge in attempts to exploit the vulnerability after news of the issue emerged.
The disclosure came earlier than planned after details of the security work leaked late on the previous night. PHP developers had intended to release a security update on the day of the announcement but brought the release forward following the leak.
The episode underscores a central dilemma for cybersecurity teams: identifying a vulnerability before criminals do can give organisations valuable time to defend themselves, but premature disclosure can also accelerate attempts to exploit it.
Budget assurances amid heightened scrutiny
The disruption has raised questions about the security of sensitive government information ahead of next week’s Budget, particularly given the OBR’s decision to take its website offline.
Scotland Secretary Douglas Alexander said he had received no indication of a breach affecting Budget security. He stressed that taking the OBR website down was not, in itself, evidence that information had been compromised.
The concern carries added sensitivity after the OBR’s Budget analysis was mistakenly published online ahead of former chancellor Rachel Reeves’s statement to parliament last year, giving markets early access to information with the potential to move prices.
There is no indication in the supplied information that the latest PHP vulnerability has led to a Budget breach.
For organisations running affected systems, however, the immediate priority is more straightforward: apply the security update and verify that systems are protected, or take vulnerable services offline until they can be secured.
The incident demonstrates how a weakness in a single, widely used technology can threaten services across borders — and how the race to identify software vulnerabilities is becoming increasingly intertwined with the capabilities of artificial intelligence.
Leave a Comment